CVE-2018-7792
published 2018-08-29CVE-2018-7792: A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.05%
60.4th percentile
A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to decode the password using rainbow table.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| schneider-electric | modicon_m221_firmware | < 1.6.2.0 | 1.6.2.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7w2v-5m57-6fj5: A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to
ghsa_unreviewed·2022-05-13
CVE-2018-7792 [HIGH] CWE-862 GHSA-7w2v-5m57-6fj5: A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to
A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to decode the password using rainbow table.
CISA ICS
Schneider Electric Modicon M221
cisa_ics·2018-08-28·CVSS 9.8
[CRITICAL] Schneider Electric Modicon M221
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Schneider Electric Modicon M221
Last RevisedAugust 28, 2018
Alert CodeICSA-18-240-01
## 1. EXECUTIVE SUMMARY
-
CVSS v3 7.7
- ATTENTION: Exploitable remotely
- Vendor: Schneider Electric
- Equipment: Modicon M221
- Vulnerabilities: Information Management Errors, Permissions, Privileges, and Access Controls
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities may allow unauthorized users to replay authentication sequences, overwrite passwords, or decode passwords.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
Schneider Electric reports the vulnerabili
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-08-29
Published